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Results in Brief 


What We Did 


The objective of our inspection was to describe Federal Student Aid’s (FSA) control 
activities over institutional processes for completing verification and reporting 
verification results in accordance with Federal requirements. Our inspection covered 
award years 2016-2017 and 2017-2018 (July 1, 2016, through June 30, 2018). 


What We Found 


We found that FSA implemented control activities over institutional processes for 
completing verification procedures and reporting verification results. Specifically, we 
identified five significant control activities over these processes: (1) annual compliance 
audits, (2) program reviews, (3) W code reports, (4) management information system 
(MIS) reports, and (5) verification guidance. 


We found that FSA performed ongoing monitoring of the verification guidance control 
activity; but FSA did not monitor the other control activities on a regular basis. However, 
in September 2018, FSA’s Enterprise Risk Management (ERM) group issued a document 
titled “Verification Internal Review Report” (ERM Report) that described its separate 
evaluation of the processes FSA had in place to ensure institutions” performed 
verification. We found that FSA did not address all of the control issues identified in the 
ERM Report and did not always determine the appropriate corrective actions or 
complete or document the corrective actions taken. 


What We Recommend 


We recommend that FSA’s Acting Chief Operating Officer (1) establish and operate 
monitoring activities, including ongoing monitoring, separate evaluations, or a 
combination of the two to obtain reasonable assurance of the operating effectiveness of 
FSA’s verification control activities, (2) establish processes to ensure that FSA 
management evaluates and documents corrective actions, or if corrective actions are 
not warranted, for verification control weaknesses identified by monitoring activities, 
and (3) for issues identified with its verification control activities in the 2018 ERM Report 
and other monitoring activities, ensure that FSA management evaluates and documents 
corrective actions, or if corrective actions are not warranted. 


1 FSA also referred to the W code report as a funding reduction report. 
In this OIG report, the terms “school” and “institution” are used interchangeably. 
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FSA Comments and Our Response 


We provided a draft of this report to FSA for comment. FSA agreed with the findings and 
all but one recommendation. FSA stated that there are significant changes anticipated 
to the verification processes and reporting because of relief measures implemented in 
response to the COVID-19 Pandemic, as well as legislative changes mandated in the 
FUTURE Act and the FAFSA [Free Application for Federal Student Aid] Simplification Act. 
As these changes are implemented, FSA will review and revise procedures to ensure 
appropriate controls and monitoring. We did not make any changes to the findings or 
the recommendations based on FSA’s comments. We summarize FSA’s comments at the 
end of each finding and provide the full text of the comments at the end of the report. 
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Introduction 


Background 


Title IV of the Higher Education Act of 1965, as amended (Title IV), authorizes Federal 
financial aid for higher education students through grants and loans. A student applies 
for aid by completing the Free Application for Federal Student Aid (FAFSA). An algorithm 
is then used to determine the student’s expected family contribution, impacting the 
student’s eligibility for aid. After a student applies for aid, that student may be selected 
for a verification process to confirm the accuracy and completeness of the information 
on the FAFSA, and to confirm that the student is eligible to receive Federal financial aid 
based on the expected family contribution calculation. This verification is completed to 
ensure that students receive the appropriate amount of Federal financial aid as required 
under Title 34 of the Code of Federal Regulations, Part 668, Subpart E. 


The U.S. Department of Education (Department) annually publishes in the Federal 
Register the FAFSA data elements that an institution must verify. Verification is 
considered complete when an institution determines that either the FAFSA data 
elements are correct, or the corrected data has been submitted. Institutions are 
required to retain verification records. For award years 2016-2017 and 2017-2018, 
Federal financial aid subject to verification included annually over $26 billion in the 
Federal Pell Grant (Pell) Program and over $20 billion in Federal Direct Loans. 


Verification is an important control to help prevent improper payments of Federal 
financial aid. According to the Department’s Agency Financial Reports for fiscal years 
(FY) 2017 through 2019 (encompassing our 2-year inspection period plus the 
subsequent year), failure to verify financial data on the FAFSA was one of the underlying 
root causes of improper payments for the Pell and Federal Direct Loan programs. The 
Department estimated improper Pell payments of over $5 billion; of that amount, over 
$1.4 billion was attributed to the failure to verify FAFSA data. The Department 
estimated improper Federal Direct Loan payments of over $8 billion; of that amount, 
over $715 million was attributed to the failure to verify FAFSA data. See the following 
table for additional information. 
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Table. Estimated Improper Payments for Pell and Federal Direct Loan Programs 


Totals for FYs 
(2017-2019) 


Pell Program FY 2017 FY 2018 FY 2019? 


Total Amount of Improper 


$2,209,700,000  $2,302,360,000 $646,140,000 $5,158,200,000 
Payments 


Improper Payments Due to 
Failure to Verify Financial $790,100,000 $124,500,000 $502,850,000 $1,417,450,000 
Data 


Percentage of Payments 
Due to Failure to Verify 
Financial Data (As 35.8% 5.4% 77.8% - 
Percentage of Total 
Improper Payments) 


Federal Direct Loan FY 2017 FY 2018 FY 2019 Total for FYs 


Program (2017-2019) 


Total Amount of Improper 


$3,863,270,000  $3,752,890,000 $483,140,000 $8,097,270,000 
Payments 


Improper Payments Due to 
Failure to Verify Financial $628,100,000 $82,540,000 $4,880,000 $715,520,000 
Data 


Percentage of Payments 
Due to Failure to Verify 
Financial Data (As 16.3% 2.2% 1.0% - 
Percentage of Total 
Improper Payments) 


* The table includes data for FY 2019 because the Department implemented a new sampling 
methodology for that year, resulting in significantly lower improper payment estimates for both 
the Pell and Federal Direct Loan programs. However, for the Pell program, the percentage of 
estimated improper payments attributed to the failure to verify financial data increased 
significantly. 


During the performance of our work, we learned that Federal Student Aid (FSA) 
conducted an internal verification review that was similar in focus to our inspection. On 
September 28, 2018, FSA’s Enterprise Risk Management (ERM) group issued the 
“Verification Internal Review Report” (ERM Report). The objective of the ERM Report 
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was to determine whether FSA’s internal control activities ensured that institutions 
perform verification. The ERM Report identified most of the control activities that we 
identified during our inspection. The ERM Report was a separate evaluation that FSA 
used to monitor the design and operating effectiveness of its control activities over 
institutional processes for completing verification procedures and reporting verification 
results. 
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Finding 1. Description of FSA’s Control Activities 


Over Completing Verification and Reporting 
Verification Results 


FSA implemented control activities over institutional processes for completing 
verification procedures and reporting verification results. The significant control 
activities over these processes were: (1) annual compliance audits, (2) program reviews, 
(3) W code reports, (4) management information system (MIS) reports, and 

(5) verification guidance. 


Annual Compliance Audits 


FSA used annual compliance audits to help ensure that institutions performed 
verification procedures and reported verification results in accordance with Federal 
requirements. It also used the results of these audits in training provided to financial aid 
professionals. Institutions that participate in Federal financial aid programs are required 
to have external audits performed by independent auditors who are typically certified 
public accountants. The purpose of the audits was to provide some level of assurance 
that the institutions are administering the Federal financial aid programs in accordance 
with Federal requirements. As part of these audits, the independent auditors reviewed 
an institution’s verification policies and procedures and tested a sample of students to 
determine if the institution complied with Federal verification requirements. 


FSA’s School Participation Division was responsible for resolving compliance audits with 
findings pertaining to its programs. An audit resolution specialist reviewed an 
institution’s audit findings and related corrective action plan to determine if additional 
documentation was needed. If applicable, the specialist requested the additional 
information either verbally or through a preliminary audit determination letter. When 
an institution had a major audit finding with an error rate greater than or equal to 

10 percent, FSA generally required the institution to perform a 100-percent file review 
to determine if the issue also applied to students that were not part of the selected 
audit sample. If an institution had a large population of financial aid recipients, FSA used 
a statistically valid sampling methodology instead of the 100-percent file review process. 
When using the statistical sampling methodology, FSA selected a sample of student files 
that an institution was required to review. 


After reviewing and analyzing the audit in detail, including the results of the additional 
file reviews, the audit resolution specialist resolved and closed the finding(s) by issuing a 
final audit determination letter to the institution. The letter included, when applicable, 
information about questioned costs and repeat audit findings. 
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FSA also produced an annual list of the Top 10 audit findings based on the frequency of 
the finding category. FSA assisted institutions by using the Top 10 list as a tool for both 
training activities and compliance assistance. The Top 10 list provided high-level 
information but did not go into detail on specific audit findings. FSA used the list to 
inform schools about the most common types of issues disclosed in audit findings. For 
FY 2018, the number of verification violations ranked fifth on the list of Top 10 findings. 


Program Reviews 


FSA used program reviews to help ensure that institutions had adequate written 
verification policies and procedures and accurately completed verification procedures 
and reported verification results. The overall purpose of a program review is to evaluate 
compliance with the Title IV, HEA statute and regulations, identify liabilities owed to the 
Department for errors in compliance, and improve future institutional capabilities. As 
part of a program review, reviewers examine financial aid, academic, and fiscal records, 
interview institution staff and students, and review relevant consumer information. FSA 
has annually conducted program reviews of approximately 100 to 300 institutions out of 
about 6,000 eligible institutions. Review specialists performed 240 program reviews for 
award year 2016-2017 and 203 program reviews for award year 2017-2018. 


As part of a program review, a review specialist from FSA’s Program Compliance office 
generally selects a sample of 15 student files to review critical elements. Verification 
was identified as a program review critical student element for award years 2016-2017 
and 2017-2018. Of the 15 sampled students, at least 2 were required to have been 
selected for verification. If the sample did not include a minimum of two students 
selected for verification, the reviewer was required to select additional students to 
satisfy the minimum requirement. 


According to FSA’s “Program Review Procedures,” in situations of verification error rates 
greater than 10 percent, the School Eligibility and Oversight Services office generally 
requires the institution to perform a file review of all students selected for verification if 
there is a liability associated with the error. However, if the error does not contain a 
liability, the reviewer has discretion to determine what actions to take, which could 
include expanding the sample to determine if a full file review is warranted. For cases 
where over 100 files need to be reviewed, the review specialist will offer the institution 
the option of projecting error rates and potential liabilities based on the full statistical 
sample selected by FSA for the program review. If the institution chooses the projection 
option, then the institution performs a file review for only the remainder of the 
statistical sample not tested by FSA during the program review. The results from this 
additional file review using the statistical sample will be used to project liabilities for the 
entire population. This option is intended to reduce the burden on the institution of 
conducting a full file review. 
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When a program review identified findings, FSA reviewed and documented the 
corrective actions taken by the institution. After reviewing the supporting 
documentation sent by the institution for the corrective action, FSA would determine 
whether the corrective action provided by the institution would fix the underlying issue. 
At the conclusion of a program review, a final program review determination letter was 
provided to the institution, which served to inform the institution of the final 
determination for each of the findings in the program review report. Also, the OIG 
Proprietary School Audit Guide? requires an auditor to review all final program review 
determination letters issued because of program reviews performed by FSA. The 
purpose of this audit procedure is to ascertain if the program review findings had been 
resolved. 


W Code Reports 


The Funds Management Division within the Business Operations office used W code 
reports to help ensure that institutions reported verification completion for students 
that received Pell awards. The W code reports identified verification W status codes 
reported by institutions. A verification W status code identifies instances where 
students were selected for verification, but the institution chose to make an initial 
disbursement of Pell funds without first obtaining verification documentation from the 
student. According to FSA’s W Code Report Procedures for Verification, the institution 
must submit the student’s disbursement record to the Common Origination and 
Disbursement (COD) System with a W code, indicating “without documentation.” COD 
would accept only one disbursement, with a disbursement amount of up to 50 percent 
of the student’s scheduled Pell award, until the institution updated the code to show 
completion of verification. Before a second disbursement could be made, the institution 
was required to change the student’s verification status code from W to either V 
(verified) or S (satisfied exclusion),* indicating that the institution completed verification 
for the student, or the student met one of the criteria to be excluded from verification. 


FSA used the W code reports as part of a three-phase W code process: (1) preview, 
(2) warning, and (3) reduction. FSA previewed and validated student disbursement data 


3 The full name of this document is “Guide for Audits of Proprietary Schools and for Compliance 
Attestation Engagements of Third-Party Servicers Administering Title IV Programs,” issued 
September 2016. 


“Verification exclusions include (1) the student died before verification was completed; (2) the student 
was not an aid recipient; (3) the student was eligible to receive only unsubsidized student financial 
assistance, (4) the student was verified by another school; and (5) the student was selected for 
verification after ceasing to be enrolled at the school. 
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provided by institutions, and then warned institutions to complete verification for the 
W code students within 2 weeks. If an institution did not change the student’s status 
code to either V or S within the prescribed time, then COD would reduce the student’s 
first disbursement to zero. FSA performed these W code procedures three times during 
each award year. 


MIS Reports 


The Partner Participation and Oversight Directorate and the School Participation 
Division used MIS reports for Pell recipients to identify the frequency of S (satisfied 
exclusion) and blank verification status codes reported by individual institutions. The 
MIS reports were used to identify institutions not performing verification and to 
determine whether an institution should be referred to the Partner Participation and 
Oversight office for a program review or to an Institution Improvement Specialist for 
compliance assistance, training, or support. FSA used the MIS Reports in conjunction 
with other available information, such as audit history, to determine whether a program 
review was required. If FSA decided to conduct a program review, the School Eligibility 
Service and Oversight office could use its discretion to determine whether there would 
be an on-site program review or desk review. 


The award year 2017 MIS Reports included a list of eight institutions that had numerous 

S or blank verification status codes. Two of those institutions were referred for program 

reviews. The other six institutions were referred to an institution improvement specialist 
to obtain assistance concerning verification status code requirements. 


Verification Guidance 


FSA used verification guidance as a control activity over its administration of the 
verification process. Verification guidance was a tool used to inform institutions of their 
responsibilities and ensured that the most recent verification procedures and 
requirements were available. Verification guidance was disseminated through Federal 
Register notices, the Application and Verification Guide (part of the FSA Handbook), 
Dear Colleague Letters, and electronic announcements. FSA’s Student Experience and 
Aid Delivery office and the Policy Implementation and Liaison office collaborated with 
the Office of Postsecondary Education, which was responsible for overall guidance for 
the Title lV programs within the Department. The FSA offices also considered feedback 
from other relevant sources when updating verification guidance; those sources 
included other Federal agencies, stakeholders, and the public. 


FSA Comments 


FSA agreed with the finding and stated that it has implemented multiple control 
activities over institutional processes for completing verification procedures and 
reporting verification results. 

U.S. Department of Education 
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Finding 2. FSA Could Improve Its Monitoring of 


Verification Control Activities 


FSA performed ongoing monitoring of the verification guidance control activity; 
however, FSA did not monitor the other control activities on a regular basis. In 

August 2018, FSA’s ERM internal review group conducted a separate evaluation of the 
processes FSA had in place to ensure institutions performed the required verification of 
FAFSA information. In September 2018, the ERM group issued its report, which covered 
five control activities over the verification processes, primarily for FYs 2014-2016. The 
ERM Report identified weaknesses in each of the five control activities. We found that 
FSA did not always address the control issues identified in the ERM Report and did not 
always determine the appropriate corrective actions or complete or document the 
corrective actions taken. 


The five control activities covered in the ERM Report are annual compliance audits, 
program reviews, W code reports, MIS reports, and FSA’s A-123 assessments? of its 
controls over school eligibility requirements. 


The ERM Report included 12 recommendations to improve the 5 verification control 
activities. FSA provided feedback or took actions to address several of the 
recommendations. However, for most of the 12 recommendations, FSA did not 
document whether it took corrective actions or determined that corrective actions were 
not warranted. Following is a discussion of specific weaknesses in verification control 
activities the ERM report identified, selected recommendations, and FSA’s responses to 
the recommendations. 


Annual Compliance Audits 


The ERM Report concluded that the small sample sizes resulting from audit procedures 
for public, not-for-profit, and proprietary institutions fail to identify institutions not 
performing verification and that this sampling methodology fails to provide an 
“assurance of compliance with the verification requirements.” 


To address the weakness, the ERM Report recommended that FSA work with OIG and 
the Office of Management and Budget (OMB) to increase the required sample size for 
verification testing. Program Compliance agreed with that recommendation. OMB is 


> In accordance with the Office of Management and Budget Circular A-123, “Management’s 
Responsibility for Enterprise Risk Management and Internal Control,” FSA management annually 
assesses and concludes on the effectiveness of its internal controls. Verification controls are assessed 
every three years, in the A-123 process, as part of FSA’s “student eligibility” testing. 
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responsible for issuing guidance for audits of public and not-for-profit institutions; and 
OIG is responsible for issuing guidance for audits of proprietary institutions. Program 
Compliance communicated with OMB to revise the guidance on sampling for audits of 
public and not-for-profit institutions. According to the Program Compliance official, 
OMB did not increase the required sample size for such audits but did include a 
statement in its guidance reinforcing the overall importance of sampling. However, 
Program Compliance did not communicate with OIG about changing verification 
sampling requirements in the OIG’s guidance on sampling for audits of proprietary 
institutions. 


Program Reviews 


The ERM Report identified potential weaknesses of the program review control activity 
such as noting that institutions were not selected for program reviews based on 
verification related risk factors, program reviews might not always provide adequate 
coverage to determine whether institutions were properly conducting verification 
activities, and the deterrent impact of program reviews might be limited by Program 
Compliance allowing institutions to retroactively perform verification if issues were 
found. The ERM Report recommended that FSA (1) determine whether it should include 
a risk factor related to verification in selecting institutions for program review; 

(2) consider selecting a separate sample of students selected for verification to test 
institutions’ compliance with the verification criteria; and (3) consider imposing a 
penalty on institutions that failed to perform verification to encourage institutions to 
perform verification, such as imposing a penalty on repeat offenders. 


In response to the ERM Report recommendations, Program Compliance stated that it 
would consider including a verification risk factor in the FY 2020 annual risk assessment. 
Ultimately, FSA complied with this recommendation and included verification in its 

FY 2020 annual risk assessment. However, Program Compliance did not provide a 
response to either of the other two recommendations in the ERM Report because the 
recommendations were presented for its consideration. 


W Code Reports 


The ERM Report stated that the W code report funding reduction process was, for the 
most part, an effective control for ensuring that Pell disbursements were recovered 
when appropriate verification activities have not been performed by institutions. The 
ERM Report also stated that there is no similar control for subsidized loans to prevent or 
recover improperly disbursed amounts. The ERM Report presented four 
recommendations for this key control, and Business Operations provided comments on 
the recommendations. In its comments, Business Operations questioned the feasibility 
of two of the recommendations. FSA did not document whether it took corrective 
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actions in response to the recommendations, or if corrective actions were not 
warranted. 


MIS Reports 


ERM concluded that the MIS Reports were no longer an adequate control for 
determining which institutions were performing verification, and presented three 
recommendations: 


e Reconsider the usefulness of the MIS Reports. 


e Determine whether there were other data elements available to FSA that could 
predict when an institution was not performing verification. 


e Perform trend analysis to determine systemic issues and develop a process for 
correcting those issues. 


ERM received no comments in response to the control issues identified with the MIS 
Reports. An FSA Senior Advisor explained that FSA made no changes to the MIS Reports 
because the MIS Reports were developed as part of FSA’s corrective action to the 

2007 OIG audit report (ED-OIG/A09G0012). 


Standards for Internal Controls in the Federal Government 


The General Accounting Office's Standards for Internal Control! in the Federal 
Government, The Green Book, established internal controls for Federal entities. Internal 
controls should provide a reasonable assurance that an entity’s objectives will be 
achieved. Those internal controls state that management should— 


1. design control activities to achieve objectives and respond to risks (10.01); 


2. establish and operate monitoring activities to monitor the internal control system 
and evaluate the results (16.01); 


3. evaluate and document the results of ongoing monitoring and separate evaluations 
to identify internal control issues, using the evaluation to determine the 
effectiveness of the internal control system (16.09); 


4. remediate identified internal control deficiencies on a timely basis (17.01); 


5. evaluate and document internal control issues and determine from the type of 
internal control deficiency the appropriate corrective actions to remediate the 
internal control deficiency on a timely basis (17.05); and 


6. complete and document corrective actions; resolution is complete only after action 
has been taken that (a) corrects the identified deficiencies, (b) produces 
improvements, or (c) demonstrates that findings and recommendations do not 
warrant management action (17.06). 
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Improvements in Monitoring Verification Internal Controls 
Needed 


FSA offices responsible for the identified control activities performed ongoing 
monitoring of the verification guidance control activity; but FSA did not monitor the 
other control activities on a regular basis. However, in September 2018, FSA’s internal 
review group issued its ERM Report that described its separate evaluation of the 
processes FSA had in place to ensure institutions performed verification. We found that 
FSA did not address all of the control issues identified in the ERM Report and did not 
always determine the appropriate corrective actions or complete or document the 
corrective actions taken. 


The ERM group could not provide documentation of how each recommendation in the 
ERM Report was resolved or responded to because, in 2018, implementation of the 
recommendations was optional, and documentation of actions taken was not required. 
The ERM group stated that where the ERM Report indicates no comment was received, 
it was understood that offices involved agreed with the recommendations but did not 
provide written responses. In addition, it was not required for the ERM group to 
conduct follow-up actions on their recommendations. According to the ERM Internal 
Review Director, the ERM group’s process did not require FSA offices to respond to 
findings or implement corrective actions because the reporting process was considered 
internal. In addition, where the ERM Report recommendations stated to “consider,” it 
was understood that the appropriate offices would consider the recommendations and 
conduct their own analysis before deciding on an exact approach. 


The ERM Report acknowledged verification as one of the primary control activities used 
by FSA to ensure the accuracy of Title lV program payments to students. According to 
the Department’s Agency Financial Reports for FYs 2017 and 2018, the Pell and Federal 
Direct Loan programs were susceptible to significant improper payments. It is important 
for FSA to monitor its verification control activities and address control issues identified 
because one cause of improper payments was the failure to verify financial data on the 
FAFSA application. For that 2-year period, the Department estimated improper Pell 
payments of over $4.5 billion, with over $914 million of that due to the failure to verify 
financial data. For the same period, the Department estimated improper Federal Direct 
Loan payments of over $7.6 billion, with over $710 million of that due to the failure to 
verify financial data. 


The OIG issued a series of reports from 2018 through 2020 to determine whether 
selected institutions completed verification of applicant data in accordance with Federal 
requirements and accurately reported verification results to FSA. We found some 
institutions had issues with completing verification and reporting verification results. 
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We performed related audits at six institutions.® For all six of the selected institutions, 
we found that the institutions generally performed verification procedures and reported 
verification results. However, for five of the six institutions, we found that the 
completion and reporting were not always conducted accurately. The estimated 
completion error rates ranged from a 1.7 percent to 15 percent, and the estimated 
reporting error rates ranged from 1.7 percent to 16.7 percent. 


Because FSA did not address all ERM Report recommendations, FSA has missed an 
opportunity to improve its verification control activities. 


Recommendations 


We recommend that FSA’s Acting Chief Operating Officer— 


2.1 Establish and operate monitoring activities, including ongoing monitoring, separate 
evaluations, or a combination of the two to obtain reasonable assurance of the 
operating effectiveness of FSA’s verification control activities. 


2.2 Establish processes to ensure that FSA management evaluates and documents 
corrective actions, including when corrective actions are not taken, for verification 
control weaknesses identified by monitoring activities. 


2.3 For issues identified with its verification control activities in the 2018 ERM Report 
and other monitoring activities, ensure that FSA management evaluates and 
documents corrective actions, or if corrective actions are not warranted. 


FSA Comments 


FSA agreed with the finding that it could improve its monitoring of verification control 
activities. FSA stated that the September 2018 report issued by FSA’s ERM group 
described the separate evaluation of the processes FSA had in place to ensure 
institutions performed verification, but FSA could improve its monitoring and 
documentation. 


FSA agreed with two of the three recommendations and noted that it anticipates 
significant changes to verification processes and reporting. FSA stated that those 
anticipated changes will come from relief measures implemented in response to the 
COVID-19 pandemic, as well as legislative changes mandated in the FUTURE Act and the 
FAFSA Simplification Act enacted as part of the Consolidated Appropriations Act, 2021. 


5 See Appendix A for a list of the six audits. Three of the audits covered award year 2016-2017 
(July 1, 2016, through June 30, 2017) and three of the audits covered award year 2017-2018 
(July 1, 2017, through June 30, 2018). 
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FSA also stated that, as these changes are implemented, it will review and revise its 
procedures as appropriate to ensure appropriate controls and monitoring. 


Regarding Recommendation 2.1, FSA stated that it disagrees with this recommendation 
because, as documented, FSA has implemented multiple control activities over 
institutional processes for completing verification procedures and has conducted a 
separate evaluation documented through the ERM report. 


FSA agreed with Recommendations 2.2 and 2.3. Specifically, for Recommendation 2.2, 
FSA stated that it agrees with this recommendation but reserves the right to not 
develop corrective action plans when management demonstrates that findings and 
recommendations do not warrant management action or that such action will be 
rendered ineffective due to anticipated changes to verification processes and reporting. 
Regarding Recommendation 2.3, FSA stated it agrees with this recommendation and has 
also reviewed the ERM report. FSA further stated that, as significant changes to 
verification processes and reporting are implemented because of COVID-19 relief 
provisions and implementation of the FUTURE and FAFSA Simplification Acts, FSA will 
continue to monitor these activities and evaluate and document corrective actions as 
appropriate. 


OIG Response 


Regarding Recommendation 2.1, we acknowledge that FSA has implemented the 
verification control activities that we described in this report, and we acknowledge that 
FSA performed its own separate evaluation of verification control activities. However, as 
noted by FSA in its comments to this finding, FSA could improve its regular monitoring 
of verification control activities. We are also aware that the ERM report was a one-time 
report which was not issued on an annual or otherwise cyclical basis and does not 
address management’s responsibilities to monitor verification control activities. We still 
maintain that FSA could improve its monitoring of verification control activities to 
establish and operate monitoring activities going forward. Therefore, we did not make 
any changes to the finding or the recommendation. 


FSA agreed with Recommendation 2.2, while reserving the right to not develop 
corrective action plans when FSA demonstrates that management action will be 
unwarranted or ineffective. We agree that FSA management has the right to implement 
corrective actions, or not, in response to its monitoring efforts. However, FSA should 
clearly document those decisions, as we recommend. FSA noted actions for 
Recommendation 2.3 that, if implemented, are responsive to our recommendation. 
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Appendix A. Scope and Methodology 


Our original audit objective was to determine whether FSA’s control activities ensured 
that institutions performed verification. After conducting the first three of our six 
related institutional audits, we decided to revise the objective and perform the 
remaining work as an inspection. Our objective for the inspection was to describe FSA’s 
control activities over institutional processes for completing verification and reporting 
verification results in accordance with Federal requirements. On August 23, 2019, we 
notified FSA of the revised objective and that our review would be completed as an 
inspection. We performed follow-up fieldwork at FSA in September 2019. We also 
conducted additional interviews and obtained additional documentation during the 
period September 2019 through September 2020. 


To achieve our objective, we performed the following procedures: 


e We gained an understanding of relevant verification criteria, including: 


o 34 Code of Federal Regulations, Part 668 Subpart E, Verification and 
Updating of Student Aid Application Information; 


o  FSA’s Dear Colleague Letter GEN-15-11, “2016-2017 Award Year: FAFSA 
Information to be Verified and Acceptable Documentation”; 


o Notice of FAFSA Information To Be Verified for the 2016-2017 Award Year, 
80 Federal Register 36783 (June 26, 2015); 


o Dear Colleague Letter GEN-17-04: “Changes to 2016-2017 and 2017-2018 
Verification Requirements”; 


o OMB Circular No. A-123; 
o FSA Strategic Plan; and 
o FSA’s 2016-2017, “Application and Verification Guide.” 
e Weassessed the results of prior audits pertaining to the verification process: 
o Two audits of FSA: 


e Department of Education’s Oversight of the Free Application for Federal 
Student Aid Verification Process (AO9GO0012)—|ssued August 2007 


e Federal Student Aid’s Oversight of Schools Participating in the Title IV 
Programs (A03L0001)—\|ssued September 2015 


e Weassessed the results of audits we performed at six institutions: 
o MiraCosta College (ED-OIG/A02S0007)—Issued November 2018 


o College of Southern Nevada (ED-OIG/A05S0012)—Issued November 2018 
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o University of Houston (ED-OIG/A06S0007)—Issued November 2018 
o DeVry University (ED-OIG/AO5TO009)—Issued August 2019 


o South Florida Institute of Technology (ED-OIG/AO6T0004)—Issued 
September 2019 


© University of Southern California (ED-OIG/AOSTO008)—Issued 
February 2020 


e We gained an understanding of FSA’s monitoring activities over FSA’s 
verification controls by interviewing staff from the FSA offices involved in 
administering and assessing the verification process, including the monitoring of 
verification completion and reporting by institutions. 


e We reviewed FSA’s September 28, 2018, ERM document “Verification Internal 
Review Report.” 


e We gained an understanding of FSA’s control activities by reviewing FSA’s 
control activity documentation (policies, procedures, and processes) related to 
institutions completing verification and reporting verification results, including: 


o Program review procedures covering verification, including annual risk 
assessments; 


o Program review instructions for Program Compliance including annual risk 
assessments; 


o Compliance audit resolution analysis procedures; 
o MIS Reports; 
o COD 2017-2018 technical reference; 


o Instructions for the verification process specific to the Central Processing 
System and COD system; 


o Guidance provided by FSA to institutions (such as FSA handbook and 
application and verification guide); and 


o  FSA’s resolution of verification findings reported in program reviews and 
audits. 


e We gained an understanding of FSA’s annual A-123 assessment of the 
effectiveness of its internal controls. We did not consider the A-123 assessment 
to be a monitoring activity over FSA’s verification controls because it did not 
test all of FSA’s verification control activities. In addition, the A-123 assessment 
reviewed verification processes only once every 3 years as a small part of 
student eligibility testing by performing tests of the verification flags for student 
identity and high school completion status. 
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We held an entrance meeting with FSA officials on April 10, 2018. We placed this project 
on hold in June 2018 to perform the audits at the six selected institutions. Three of the 
institutions (College of Southern Nevada, MiraCosta College, and University of Houston) 
were audited for award year 2016-2017, and the remaining three (DeVry University, 
South Florida Institute of Technology, and University of Southern California) were 
audited for award year 2017-2018. We took the project off hold in August 2019. 


In June 2020, FSA provided the ERM Verification Internal Review Report. We followed 
up on issues identified in that report. Our follow-up work included additional interviews 
of FSA officials. We held an exit meeting on November 19, 2020. 


Compliance with Standards 


We conducted our work in accordance with the Council of Inspectors General on 
Integrity and Efficiency “Quality Standards for Inspection and Evaluation.” Those 
standards require that we plan the work to obtain sufficient data and other information 
to provide a reasonable basis for our conclusions. 
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Appendix B. Acronyms and Abbreviations 


COD Common Origination and Disbursement 

Department U.S. Department of Education 

ERM Enterprise Risk Management 

ERM Report Verification Internal Review Report 

FAFSA Free Application for Federal Student Aid 

FSA Federal Student Aid 

FY fiscal year 

MIS Management Information System 

OMB Office of Management and Budget 

Pell Federal Pell Grant Program 

Title IV Title IV of the Higher Education Act of 1965, as 
amended 
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FSA Comments 


April 16, 2021 


TO; Ms. Myra Hamilton, 
Acting Regional Inspector General for Audit 
U.S. Department of Education 
Office of Inspector General 


Mr. Jeffrey Nekrasz, Director Student Financial Assistance Advisory and 
Assistance 

Office of Inspector General 

U.S. Department of Education 


FROM: Robin Minor <26ae DS. Wher 


Acting Chief Operating Officer 
Federal Student Aid 


SUBJECT: Draft Report “Federal Student Aid Controls Over the School Verification Process” 
Control Number ED-OIG/1I06S0001 


Dear Ms. Hamilton: 


Thank you for the opportunity to review and comment on the statements and recommendations made 
in the Office of Inspector General (“OIG”) Draft Report, /‘ederal Student Aid Controls Over the 
School Verification Process (10680001), dated April 2, 2021 (“Draft Report”). 


OIG presented two findings in the Draft Report, with three recommendations. Federal Student Aid’s 
(FSA’s) response to the findings and recommendations are below. 


The Draft Report documents multiple processes already in place related to control over verification 
and reporting and detailed by FSA’s internal Enterprise Risk Management (ERM) report. The ERM 
report was a separate, internal evaluation that FSA used to monitor the design and operating 
effectiveness of its control activities. 


Finding 1: Description of FSA’s Control Activities Over Completing Verification and Reporting 
Verification Results 


FSA’s Response: FSA agrees with the OIG’s finding that FSA has implemented multiple control 
activities over institutional processes for completing verification procedures and reporting verification 
results. 


Federal Student Aid 


An OFFICE of the U.S. DEPARTMENT of EDUCATION 


830 First Street, NE, Washington, DC 20202 
StudentAid.gov 


U.S. Department of Education 
Office of Inspector General 
ED-OIG/106S0001 20 


Page 2 


Finding 2: FSA Could Improve Its Monitoring of Verification Control Activities 


FSA’s Response: FSA agrees with the OIG’s finding that FSA could improve its regular monitoring 
of control activities. The September 2018 report by FSA’s ERM group, cited by the OIG, described 
the separate evaluation of the processes FSA had in place to ensure institutions performed verification, 
but FSA can improve monitoring and documentation. 


It is important to note that there are significant changes anticipated to verification processes and 
reporting as a result of relief measures implemented in response to the Covid-19 pandemic, as well as 
legislative changes mandated in the FUTURE Act and the FAFSA Simplification Act as part of the 
Consolidated Appropriations Act, 2020. As these changes are implemented, FSA will review and 
revise our procedures as appropriate to ensure appropriate controls and monitoring. 


Recommendation 2.1: OIG recommended that FSA’s Acting Chief Operating Officer establish 
and operate monitoring activities, including ongoing monitoring, separate evaluations, or a 
combination of the two to obtain reasonable assurance of the operating effectiveness of FSA’s 
verification control activities. 


FSA’s Response: FSA disagrees with the OIG’s recommendation because, as documented, FSA has 
implemented multiple control activities over institutional processes for completing verification 
procedures and has conducted a separate evaluation documented through the ERM report. 


Again, as changes to verification processes and reporting are implemented as a result of relief 
measures in response to the Covid-19 pandemic and recent legislative changes, FSA will review and 
revise our procedures as appropriate to ensure appropriate controls and monitoring. 


Recommendation 2.2: OIG recommended that FSA’s Acting Chief Operating Officer establish 
processes to ensure that FSA management evaluates and documents corrective actions, or if 
corrective actions are not warranted, for verification control weaknesses identified by 
monitoring activities. 


FSA’s Response 2.2: FSA agrees with the OIG’s recommendation, but reserves the right not to 
develop corrective action plans when management demonstrates that findings and recommendations 
do not warrant management action, or such action will be rendered ineffective due to anticipated 
changes to verification processes and reporting. 


Recommendation 2.3: OIG recommended that FSA’s Acting Chief Operating Officer, for issues 
identified with its verification control activities in the 2018 ERM Report and other monitoring 
activities, ensure that FSA management evaluates and documents corrective actions, or if 
corrective actions are not warranted. 


FSA’s Response: FSA agrees with this recommendation and has also reviewed the ERM report. As 
significant changes to verification processes and reporting are implemented as a result of Covid-19 
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relief provisions and implementation of the FUTURE and FAFSA Simplification Act, FSA will 
continue to monitor these activities and evaluate and document corrective actions, as appropriate. 


Thank you for the opportunity to respond to the recommendations outlined in this OIG draft report. 
We appreciate the time and the effort auditing this issue, as well as the opportunity to comment. 
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